org.acegisecurity.intercept.web
Class SecurityEnforcementFilter

java.lang.Object
  org.acegisecurity.intercept.web.SecurityEnforcementFilter

All Implemented Interfaces:

javax.servlet.Filter, InitializingBean

public class SecurityEnforcementFilter
extends Object
implements javax.servlet.Filter, InitializingBean

Wraps requests to the FilterSecurityInterceptor.

This filter is necessary because it provides the bridge between incoming requests and the FilterSecurityInterceptor instance.

If an AuthenticationException is detected, the filter will launch the authenticationEntryPoint. This allows common handling of authentication failures originating from any subclass of AbstractSecurityInterceptor.

If an AccessDeniedException is detected, the filter will determine whether or not the user is an anonymous user. If they are an anonymous user, the authenticationEntryPoint will be launched. If they are not an anonymous user, the filter will respond with a HttpServletResponse.SC_FORBIDDEN (403 error). In addition, the AccessDeniedException itself will be placed in the HttpSession attribute keyed against ACEGI_SECURITY_ACCESS_DENIED_EXCEPTION_KEY (to allow access to the stack trace etc). Again, this allows common access denied handling irrespective of the originating security interceptor.

To use this filter, it is necessary to specify the following properties:

• filterSecurityInterceptor indicates the FilterSecurityInterceptor to delegate HTTP security decisions to.
• authenticationEntryPoint indicates the handler that should commence the authentication process if an AuthenticationException is detected. Note that this may also switch the current protocol from http to https for an SSL login.
• portResolver is used to determine the "real" port that a request was received on.

Do not use this class directly. Instead configure web.xml to use the FilterToBeanProxy.

Version:

$Id: SecurityEnforcementFilter.java,v 1.22 2005/11/25 04:38:18 benalex Exp $

Author:

Ben Alex, colin sampaleanu

Field Summary

static String

ACEGI_SECURITY_ACCESS_DENIED_EXCEPTION_KEY

Constructor Summary

SecurityEnforcementFilter()

Method Summary

void	afterPropertiesSet()
void	destroy()
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)
AuthenticationEntryPoint	getAuthenticationEntryPoint()
AuthenticationTrustResolver	getAuthenticationTrustResolver()
FilterSecurityInterceptor	getFilterSecurityInterceptor()
PortResolver	getPortResolver()
void	init(javax.servlet.FilterConfig filterConfig)
boolean	isCreateSessionAllowed() If true, indicates that SecurityEnforcementFilter is permitted to store the target URL and exception information in the HttpSession (the default).
protected void	sendAccessDeniedError(FilterInvocation fi, AccessDeniedException accessDenied)
protected void	sendStartAuthentication(FilterInvocation fi, AuthenticationException reason)
void	setAuthenticationEntryPoint(AuthenticationEntryPoint authenticationEntryPoint)
void	setAuthenticationTrustResolver(AuthenticationTrustResolver authenticationTrustResolver)
void	setCreateSessionAllowed(boolean createSessionAllowed)
void	setFilterSecurityInterceptor(FilterSecurityInterceptor filterSecurityInterceptor)
void	setPortResolver(PortResolver portResolver)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

ACEGI_SECURITY_ACCESS_DENIED_EXCEPTION_KEY

public static final String ACEGI_SECURITY_ACCESS_DENIED_EXCEPTION_KEY

See Also:

Constant Field Values

Constructor Detail

SecurityEnforcementFilter

public SecurityEnforcementFilter()

Method Detail

setAuthenticationEntryPoint

public void setAuthenticationEntryPoint(AuthenticationEntryPoint authenticationEntryPoint)

getAuthenticationEntryPoint

public AuthenticationEntryPoint getAuthenticationEntryPoint()

setAuthenticationTrustResolver

public void setAuthenticationTrustResolver(AuthenticationTrustResolver authenticationTrustResolver)

isCreateSessionAllowed

public boolean isCreateSessionAllowed()

If true, indicates that SecurityEnforcementFilter is permitted to store the target URL and exception information in the HttpSession (the default). In situations where you do not wish to unnecessarily create HttpSessions - because the user agent will know the failed URL, such as with BASIC or Digest authentication - you may wish to set this property to false. Remember to also set the HttpSessionContextIntegrationFilter.allowSessionCreation to false if you set this property to false.

Returns:

true if the HttpSession will be used to store information about the failed request, false if the HttpSession will not be used

setCreateSessionAllowed

public void setCreateSessionAllowed(boolean createSessionAllowed)

getAuthenticationTrustResolver

public AuthenticationTrustResolver getAuthenticationTrustResolver()

setFilterSecurityInterceptor

public void setFilterSecurityInterceptor(FilterSecurityInterceptor filterSecurityInterceptor)

getFilterSecurityInterceptor

public FilterSecurityInterceptor getFilterSecurityInterceptor()

setPortResolver

public void setPortResolver(PortResolver portResolver)

getPortResolver

public PortResolver getPortResolver()

afterPropertiesSet

public void afterPropertiesSet()
                        throws Exception

Specified by:

afterPropertiesSet in interface InitializingBean

Throws:

Exception

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter

doFilter

public void doFilter(javax.servlet.ServletRequest request,
                     javax.servlet.ServletResponse response,
                     javax.servlet.FilterChain chain)
              throws IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

IOException

javax.servlet.ServletException

init

public void init(javax.servlet.FilterConfig filterConfig)
          throws javax.servlet.ServletException

Specified by:

init in interface javax.servlet.Filter

Throws:

javax.servlet.ServletException

sendAccessDeniedError

protected void sendAccessDeniedError(FilterInvocation fi,
                                     AccessDeniedException accessDenied)
                              throws javax.servlet.ServletException,
                                     IOException

Throws:

javax.servlet.ServletException

IOException

sendStartAuthentication

protected void sendStartAuthentication(FilterInvocation fi,
                                       AuthenticationException reason)
                                throws javax.servlet.ServletException,
                                       IOException

Throws:

javax.servlet.ServletException

IOException